Google (NASDAQ:GOOG) said it is rolling out a fix for a
quirky bug in the integration between Google Talk and Google+ that can give
users access to the instant messaging contacts and conversations of other users
on shared computers.

Google Talk is the search engine's instant messaging client.
Google+ is the new social network that has racked up 25 million-plus users
since its launch in limited field trial June 28. Users may
initiate chat conversations in Google+ similar to the way they do in Gmail.

The flaw,
detected by GigaOm writer Janko Roettgers, could let users view the chat
sessions of others. However, it's not so easy to reproduce as it requires
special circumstances -- sharing a computer between two or more users -- to
trigger the flaw.
In order to
trigger the bug, a user must log into Gmail and Google+, leaving both windows
open on the computer. Then the WiFi connection goes out, dropping the sync capability
from the Talk session.
Suppose another user takes the computer, logs the
original user out and logs in with his or her own Gmail account. The Talk
session from the first user reconnects, but does so via the second user's Talk
account.
Suppose the second user simply closes the browser window
and returns the computer to the original user without logging out. When the
first user accesses his Gmail account, he'll see that he is still logged into
the second user's Talk session in his Google+ page.
Here is where the bug becomes a little more serious; the
first user will be then able to view any Talk instant messages relayed from the
second user from a different computing device.
In other words, because the
second user used the first user's computer, even for a little bit, that first
user's computer hijacks his or her Talk chat sessions.
This same flaw and
results may also be triggered by users with multiple Gmail accounts. Specifically, the chat in Google+ loads with the last logged-in user even if Google+ shows another profile.
The bug is squashed when the second user signs out of the
Gmail account because the session vanishes. While serious in theory, the flaw
is minor in practice because it's only triggered when the right user scenarios
align; not everyone is sharing computers or has multiple Google accounts.
Google recommends that users log out of their
accounts when sharing their computers.
Still, it's a good reminder of how Google+ is ripe for bug
detection. Within hours of launching Google+, Google heard complaints
from users about not being able to control whether their posts were
reshared. Google now lets users disable resharing before they post on Google+.
"There's going to be bugs in our product," a
Google spokesperson told eWEEK. "This is why + is still in a field trial.
We want to catch these bugs before we open the floodgates to the whole
world."